always remember user, use rememberme cookie for encryption key